[mapserver-commits] [MapServer/MapServer] b93dad: OGC API Features: validate offset before rendering...

[Philip G.]

  Branch: refs/heads/main
  Home:   https://github.com/MapServer/MapServer
  Commit: b93dad31a42ad4896ad768b0b4bd85848928bf07
      https://github.com/MapServer/MapServer/commit/b93dad31a42ad4896ad768b0b4bd85848928bf07
  Author: Philip G. <44811794+PhilipPhil at users.noreply.github.com>
  Date:   2026-07-10 (Fri, 10 Jul 2026)

  Changed paths:
    A msautotest/api/expected/ogcapi_collections_mn_counties_items_offset_xss.json.txt
    M msautotest/api/ogcapi.map
    M src/mapogcapi.cpp

  Log Message:
  -----------
  OGC API Features: validate offset before rendering to fix reflected XSS (GHSA-288j-mhpj-gmmr) (#7573)

The "offset" query parameter was only parsed and validated inside the
numberMatched > 0 branch of processCollectionItemsRequest(). When a bbox
query matched zero features, that validation was skipped and the raw,
unescaped value flowed into template.params.offset, which the HTML
collection-items template renders directly into a <script> block. A
non-numeric offset (e.g. </script><img src=x onerror=alert(1)>) therefore
produced reflected XSS on any zero-match OGC API Features items request.

Parse and validate offset (integer, non-negative) unconditionally at the
start of the bbox query path, so bad values are rejected with a 400
"Bad value for offset." error before any template is rendered. The
upper-bound (offset >= numberMatched) range check stays where numberMatched
is known. Behaviour for valid offsets is unchanged.

Add an msautotest case that sends the XSS payload on a zero-match bbox with
f=html and asserts the JSON 400 error, confirming the response is
application/json rather than reflected text/html.

Co-authored-by: Philip Garabandic <pgarabandic3 at gatech.edu>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply at anthropic.com>



To unsubscribe from these emails, change your notification settings at https://github.com/MapServer/MapServer/settings/notifications